The originating host may perform Maximum transmission unit (MTU) path discovery to determine the packet size that can be transmitted without fragmentation, and then set the don't fragment (DF) bit in the appropriate packet header field. One solution is for the receiving NAT to reassemble the entire segment and then recompute a checksum calculated across all packets. NAT must recompute the IP checksum on every packet it passes to the destination host, and also recognize and recompute the TCP/UDP header using the retranslated addresses and pseudo-header. For an originating NAT to pass TCP or UDP successfully, it must recompute the TCP/UDP header checksum based on the translated IP addresses, not the original ones, and put that checksum into the TCP/UDP header of the first packet of the fragmented set of packets. The major transport layer protocols, TCP and UDP, have a checksum that covers all the data they carry, as well as the TCP/UDP header, plus a "pseudo-header" that contains the source and destination IP addresses of the packet carrying the TCP/UDP header. IP datagrams may become fragmented and it is necessary for a NAT to reassemble these fragments to allow correct recalculation of higher-level checksums and correct tracking of which packets belong to which connection. IP packets have a checksum in each packet header, which provides error detection only for the header. As soon as the protocol stack is traversed, even with such basic protocols as TCP and UDP, the protocols will break unless NAT takes action beyond the network layer.
"Pure NAT", operating on IP alone, may or may not correctly parse protocols that are totally concerned with IP information, such as ICMP, depending on whether the payload is interpreted by a host on the "inside" or "outside" of translation. However the external host is only aware of the public IP address for the NAT device and the particular port being used to communicate on behalf of a specific internal host. Typically the NAT device may function as the default gateway for the internal host. Typically the internal host is aware of the true IP address and TCP or UDP port of the external host. NAT operation is typically transparent to both the internal and external hosts. When the network has few public IP addresses and many private IP addresses require outside access When traffic that originates inside the network must be routed to internal hosts When traffic that originates outside the network must be routed to internal hosts
0 kommentar(er)
